@burdenoff/fe-libs 2026.527.5 → 2026.527.7

package/dist/shared/graphql/client.d.ts

@@ -0,0 +1,122 @@
+import { ApolloClient, InMemoryCache } from '@apollo/client/core';
+import { Gateway } from '../config';
+/**
+ * Check if the network circuit breaker is currently open (backend unreachable).
+ * Useful for showing "backend offline" banners in the UI.
+ */
+export declare function isNetworkCircuitOpen(): boolean;
+export type { Gateway } from '../config';
+export interface CreateClientOptions {
+    /** Gateway type: 'workspace' or 'global' */
+    gateway: Gateway;
+    /** Optional base URL override (defaults to gateway's defaultBaseUrl) */
+    baseUrl?: string;
+    /** Authorization token or token getter function */
+    authToken?: string | (() => string | null);
+    /** Workspace token or getter for X-Workspace-Authorization header (workspace gateway only) */
+    workspaceToken?: string | (() => string | null);
+    /** Locale code or getter function for Accept-Language header */
+    locale?: string | (() => string | null);
+    /** Geography getter for x-geo-* headers (country, currency, timezone) */
+    geography?: () => {
+        country?: string;
+        currency?: string;
+        timezone?: string;
+    } | null;
+    /** Organization ID or getter function for x-org-id header (global gateway) */
+    organizationId?: string | (() => string | null);
+    /** Product ID or getter function for x-product-id header (for product-level isolation) */
+    productId?: string | (() => string | null);
+    /** Workspace ID or getter function for x-workspace-id header (workspace context) */
+    workspaceId?: string | (() => string | null);
+    /** Tenant ID or getter function for x-tenant-id header (tenant context) */
+    tenantId?: string | (() => string | null);
+    /** Optional cache instance for sharing between clients */
+    cache?: InMemoryCache;
+    /** Enable SSE subscriptions */
+    enableSubscriptions?: boolean;
+    /** SSE endpoint URL override (defaults to gateway's sse path) */
+    sseUrl?: string;
+    /** Callback when authentication error occurs */
+    onAuthError?: () => void;
+    /**
+     * Callback to attempt token refresh when a 401/UNAUTHENTICATED error occurs.
+     * If provided, the ErrorLink will call this before invoking onAuthError,
+     * and will retry the failed operation with the new token on success.
+     * Should return `true` if refresh succeeded (token updated in storage),
+     * or `false` if refresh failed (triggers onAuthError).
+     */
+    onRefreshToken?: () => Promise<boolean>;
+    /** Callback when network error occurs */
+    onNetworkError?: (error: Error) => void;
+    /** Callback when network status changes (circuit breaker open/closed) */
+    onNetworkStatusChange?: (isOffline: boolean) => void;
+    /** Maximum retry attempts for failed requests (default: 3) */
+    maxRetryAttempts?: number;
+    /**
+     * Maximum number of operations to batch together (default: 10).
+     * Set to 1 to disable batching.
+     */
+    batchMax?: number;
+    /**
+     * Time window (ms) to collect operations before sending a batch.
+     * Defaults to a longer page-load burst window and a shorter steady-state window.
+     */
+    batchInterval?: number;
+    /** Enable debug logging */
+    debug?: boolean;
+}
+/**
+ * Creates an Apollo Client configured for a Burdenoff gateway
+ *
+ * @example Basic usage
+ * ```ts
+ * // Workspace gateway client
+ * const workspaceClient = createGraphQLClient({
+ *   gateway: 'workspace',
+ *   authToken: 'your-jwt-token',
+ * });
+ *
+ * // Global gateway client
+ * const globalClient = createGraphQLClient({
+ *   gateway: 'global',
+ *   authToken: () => localStorage.getItem('token'),
+ * });
+ * ```
+ *
+ * @example With subscriptions
+ * ```ts
+ * const client = createGraphQLClient({
+ *   gateway: 'workspace',
+ *   authToken: token,
+ *   enableSubscriptions: true,
+ * });
+ * ```
+ */
+export declare function createGraphQLClient(options: CreateClientOptions): ApolloClient;
+export interface AppClientConfig {
+    workspaceBaseUrl?: string;
+    globalBaseUrl?: string;
+    authToken?: string | (() => string | null);
+    enableSubscriptions?: boolean;
+    onAuthError?: () => void;
+    debug?: boolean;
+}
+/**
+ * Initialize app-level Apollo clients
+ * Call this once during app initialization
+ */
+export declare function initializeAppClients(config: AppClientConfig): void;
+/**
+ * Get the workspace gateway Apollo client
+ */
+export declare function getWorkspaceClient(): ApolloClient;
+/**
+ * Get the global gateway Apollo client
+ */
+export declare function getGlobalClient(): ApolloClient;
+/**
+ * Reset all singleton clients (useful for logout or testing)
+ */
+export declare function resetAppClients(): void;
+//# sourceMappingURL=client.d.ts.map

package/dist/shared/graphql/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/shared/graphql/client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAGZ,aAAa,EAId,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAAiB,KAAK,OAAO,EAAY,MAAM,WAAW,CAAC;AAkDlE;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAUD,YAAY,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,WAAW,mBAAmB;IAClC,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3C,8FAA8F;IAC9F,cAAc,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC;IAChD,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC;IACxC,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC;IACT,8EAA8E;IAC9E,cAAc,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC;IAChD,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3C,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1C,0DAA0D;IAC1D,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,+BAA+B;IAC/B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;IACzB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,yCAAyC;IACzC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACxC,yEAAyE;IACzE,qBAAqB,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,KAAK,IAAI,CAAC;IACrD,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAmFD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,gBAue/D;AASD,MAAM,WAAW,eAAe;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3C,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CA0BlE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,YAAY,CAKjD;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,YAAY,CAK9C;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAStC"}

package/dist/shared/graphql/client.js

@@ -6,53 +6,53 @@ import { SSELink as a } from "./links/sse-link.js";
 import { onError as o } from "@apollo/client/link/error";
 import { RetryLink as s } from "@apollo/client/link/retry";
 import { setContext as c } from "@apollo/client/link/context";
-import { ApolloClient as l, ApolloLink as u, InMemoryCache as ee, Observable as d, from as f, split as p } from "@apollo/client/core";
-import { getMainDefinition as m } from "@apollo/client/utilities";
-import { print as h } from "graphql";
+import { ApolloClient as l, ApolloLink as u, InMemoryCache as d, Observable as f, from as p, split as ee } from "@apollo/client/core";
+import { getMainDefinition as te } from "@apollo/client/utilities";
+import { print as m } from "graphql";
 //#region src/shared/graphql/client.ts
-var g = {
+var h = {
 	consecutiveFailures: 0,
 	lastFailureTime: 0,
 	isOpen: !1
-}, _ = 5, v = 3e4;
-function te() {
-	return g.consecutiveFailures++, g.lastFailureTime = Date.now(), g.consecutiveFailures >= _ && (g.isOpen = !0), g.isOpen;
+}, g = 5, _ = 3e4;
+function ne() {
+	return h.consecutiveFailures++, h.lastFailureTime = Date.now(), h.consecutiveFailures >= g && (h.isOpen = !0), h.isOpen;
 }
-function y() {
-	g.consecutiveFailures = 0, g.isOpen = !1;
+function v() {
+	h.consecutiveFailures = 0, h.isOpen = !1;
 }
-function b() {
-	return g.isOpen ? Date.now() - g.lastFailureTime > v ? (g.isOpen = !1, g.consecutiveFailures = 0, !1) : !0 : !1;
+function y() {
+	return h.isOpen ? Date.now() - h.lastFailureTime > _ ? (h.isOpen = !1, h.consecutiveFailures = 0, !1) : !0 : !1;
 }
-function x(e) {
+function b(e) {
 	if (!e || typeof e != "object") return null;
 	let t = e.workspaceId;
 	return typeof t == "string" && t.trim() ? t : null;
 }
-function S(e) {
+function x(e) {
 	let t = e.headers;
 	if (!t || typeof t != "object" || Array.isArray(t)) return {};
 	let n = {};
 	for (let [e, r] of Object.entries(t)) typeof r == "string" && (n[e] = r);
 	return n;
 }
-function C(e) {
+function S(e) {
 	let t = e.fetchOptions;
 	if (!t || typeof t != "object" || !("signal" in t)) return;
 	let n = t.signal;
 	return n instanceof AbortSignal ? n : void 0;
 }
-function ne({ uri: e, batchMax: t, batchInterval: n }) {
-	return new u((r) => new d((a) => {
-		let o = r.getContext(), s = { query: h(r.query) };
+function re({ uri: e, batchMax: t, batchInterval: n }) {
+	return new u((r) => new f((a) => {
+		let o = r.getContext(), s = { query: m(r.query) };
 		r.operationName && (s.operationName = r.operationName);
 		let c = r.variables ?? {}, l = r.extensions ?? {};
 		Object.keys(c).length > 0 && (s.variables = c), Object.keys(l).length > 0 && (s.extensions = l);
 		let u = !1;
 		return i(e, {
 			"content-type": "application/json",
-			...S(o)
-		}, s, C(o), {
+			...x(o)
+		}, s, S(o), {
 			batchMax: t,
 			batchInterval: n
 		}).then((e) => {
@@ -64,25 +64,25 @@ function ne({ uri: e, batchMax: t, batchInterval: n }) {
 		};
 	}));
 }
-function w(i) {
-	let { gateway: h, baseUrl: _, authToken: v, workspaceToken: S, locale: C, geography: w, organizationId: T, productId: E, workspaceId: D, tenantId: O, cache: k, enableSubscriptions: A = !1, sseUrl: j, onAuthError: M, onRefreshToken: N, onNetworkError: P, onNetworkStatusChange: F, maxRetryAttempts: re = 3, batchMax: ie = 10, batchInterval: ae, debug: I = !1 } = i, L = e[h], R = ne({
-		uri: n(t(_, h)),
+function C(i) {
+	let { gateway: m, baseUrl: g, authToken: _, workspaceToken: x, locale: S, geography: C, organizationId: w, productId: T, workspaceId: E, tenantId: D, cache: O, enableSubscriptions: k = !1, sseUrl: A, onAuthError: j, onRefreshToken: M, onNetworkError: N, onNetworkStatusChange: P, maxRetryAttempts: F = 3, batchMax: ie = 10, batchInterval: ae, debug: I = !1 } = i, L = e[m], R = re({
+		uri: n(t(g, m)),
 		batchMax: ie,
 		batchInterval: ae
 	}), z = c((e, t) => {
-		let n = t.headers ?? {}, r = typeof v == "function" ? v() : v;
+		let n = t.headers ?? {}, r = typeof _ == "function" ? _() : _;
 		return { headers: {
 			...n,
 			...r ? { authorization: `Bearer ${r}` } : {}
 		} };
 	}), B = c((e, t) => {
-		let n = t.headers ?? {}, r = typeof C == "function" ? C() : C;
+		let n = t.headers ?? {}, r = typeof S == "function" ? S() : S;
 		return { headers: {
 			...n,
 			...r ? { "accept-language": r } : {}
 		} };
 	}), V = c((e, t) => {
-		let n = t.headers ?? {}, r = typeof w == "function" ? w() : null;
+		let n = t.headers ?? {}, r = typeof C == "function" ? C() : null;
 		return { headers: {
 			...n,
 			...r?.country ? { "x-geo-country": r.country } : {},
@@ -90,31 +90,31 @@ function w(i) {
 			...r?.timezone ? { "x-geo-timezone": r.timezone } : {}
 		} };
 	}), H = c((e, t) => {
-		let n = t.headers ?? {}, r = typeof T == "function" ? T() : T;
+		let n = t.headers ?? {}, r = typeof w == "function" ? w() : w;
 		return { headers: {
 			...n,
 			...r ? { "x-org-id": r } : {}
 		} };
 	}), U = c((e, t) => {
-		let n = t.headers ?? {}, r = typeof E == "function" ? E() : E;
+		let n = t.headers ?? {}, r = typeof T == "function" ? T() : T;
 		return { headers: {
 			...n,
 			...r ? { "x-product-id": r } : {}
 		} };
 	}), W = c((e, t) => {
-		let n = t.headers ?? {}, r = (typeof D == "function" ? D() : D) || x(e.variables);
+		let n = t.headers ?? {}, r = (typeof E == "function" ? E() : E) || b(e.variables);
 		return { headers: {
 			...n,
 			...r ? { "x-workspace-id": r } : {}
 		} };
 	}), G = c((e, t) => {
-		let n = t.headers ?? {}, r = typeof O == "function" ? O() : O;
+		let n = t.headers ?? {}, r = typeof D == "function" ? D() : D;
 		return { headers: {
 			...n,
 			...r ? { "x-tenant-id": r } : {}
 		} };
 	}), K = c((e, t) => {
-		let n = t.headers ?? {}, i = typeof S == "function" ? S() : S, a = r(i, { workspaceId: typeof D == "function" ? D() : D }) ? i : null;
+		let n = t.headers ?? {}, i = typeof x == "function" ? x() : x, a = r(i, { workspaceId: typeof E == "function" ? E() : E }) ? i : null;
 		return { headers: {
 			...n,
 			...a ? { "x-workspace-authorization": `Bearer ${a}` } : {}
@@ -126,25 +126,25 @@ function w(i) {
 			jitter: !0
 		},
 		attempts: {
-			max: re,
+			max: F,
 			retryIf: (e) => {
-				if (b() || !e) return !1;
+				if (y() || !e) return !1;
 				let t = e.message?.toLowerCase?.() ?? "";
 				return !(t.includes("401") || t.includes("403") || t.includes("unauthorized") || t.includes("forbidden") || t.includes("unauthenticated"));
 			}
 		}
 	}), J = new u((e, t) => {
-		if (b()) {
+		if (y()) {
 			I && console.warn("[CircuitBreaker] Circuit is open, blocking request:", e.operationName);
 			let t = /* @__PURE__ */ Error("Network circuit breaker is open — backend appears unreachable. Retrying in 30 seconds.");
-			return P?.(t), new d((e) => {
+			return N?.(t), new f((e) => {
 				e.error(t);
 			});
 		}
-		return new d((n) => {
+		return new f((n) => {
 			let r = t(e).subscribe({
 				next: (e) => {
-					y(), g.consecutiveFailures === 0 && F?.(!1), n.next(e);
+					v(), h.consecutiveFailures === 0 && P?.(!1), n.next(e);
 				},
 				error: (e) => {
 					n.error(e);
@@ -166,30 +166,38 @@ function w(i) {
 		if (r) {
 			let i = r.some((e) => e.extensions?.code === "UNAUTHENTICATED" || e.message.includes("Unauthorized") || e.message.includes("Unauthenticated"));
 			for (let e of r) I && console.error("[GraphQL Error]:", e.message);
-			if (i && N) return new d((r) => {
+			let a = new Set(["STORAGE_QUOTA_EXCEEDED", "RESOURCE_CAP_EXCEEDED"]);
+			for (let e of r) {
+				let t = e.extensions?.code;
+				if (t && a.has(t) && typeof window < "u") {
+					window.dispatchEvent(new CustomEvent("burdenoff:upgrade-prompt", { detail: { extensions: e.extensions } }));
+					break;
+				}
+			}
+			if (i && M) return new f((r) => {
 				(async () => {
 					if (Y) if (await new Promise((e) => {
 						X.push({ resolve: e });
 					})) {
 						let e = n(t).subscribe(r);
 						return () => e.unsubscribe();
-					} else return M?.(), r.error(e), () => {};
+					} else return j?.(), r.error(e), () => {};
 					Y = !0;
 					try {
-						let i = await N();
+						let i = await M();
 						if (Y = !1, i) {
 							Z(!0);
 							let e = n(t).subscribe(r);
 							return () => e.unsubscribe();
-						} else return Z(!1), M?.(), r.error(e), () => {};
+						} else return Z(!1), j?.(), r.error(e), () => {};
 					} catch {
-						return Y = !1, Z(!1), M?.(), r.error(e), () => {};
+						return Y = !1, Z(!1), j?.(), r.error(e), () => {};
 					}
 				})();
 			});
-			i && M?.(), y();
-		} else I && console.error("[Network Error]:", e), te() && F?.(!0), e instanceof Error ? P?.(e) : P?.(Error(String(e)));
-	}), $ = f([
+			i && j?.(), v();
+		} else I && console.error("[Network Error]:", e), ne() && P?.(!0), e instanceof Error ? N?.(e) : N?.(Error(String(e)));
+	}), $ = p([
 		q,
 		J,
 		Q,
@@ -203,9 +211,9 @@ function w(i) {
 		V,
 		R
 	]);
-	if (A) {
-		let e = j || n(_ || L.defaultBaseUrl) + L.sse;
-		e && ($ = f([
+	if (k) {
+		let e = A || n(g || L.defaultBaseUrl) + L.sse;
+		e && ($ = p([
 			q,
 			J,
 			Q,
@@ -217,8 +225,8 @@ function w(i) {
 			G,
 			B,
 			V,
-			p(({ query: e }) => {
-				let t = m(e);
+			ee(({ query: e }) => {
+				let t = te(e);
 				return t.kind === "OperationDefinition" && t.operation === "subscription";
 			}, new a({
 				url: e,
@@ -227,7 +235,7 @@ function w(i) {
 			}), R)
 		]));
 	}
-	let oe = new ee({ typePolicies: {
+	let oe = new d({ typePolicies: {
 		File: { keyFields: ["id"] },
 		Folder: { keyFields: ["id"] },
 		Tag: { keyFields: ["id"] },
@@ -261,7 +269,7 @@ function w(i) {
 	} });
 	return new l({
 		link: $,
-		cache: k ?? oe,
+		cache: O ?? oe,
 		defaultOptions: {
 			watchQuery: {
 				fetchPolicy: "cache-and-network",
@@ -275,17 +283,17 @@ function w(i) {
 		}
 	});
 }
-var T = null, E = null;
-function D(e) {
+var w = null, T = null;
+function E(e) {
 	let { workspaceBaseUrl: t, globalBaseUrl: n, authToken: r, enableSubscriptions: i = !1, onAuthError: a, debug: o = !1 } = e;
-	T = w({
+	w = C({
 		gateway: "workspace",
 		baseUrl: t,
 		authToken: r,
 		enableSubscriptions: i,
 		onAuthError: a,
 		debug: o
-	}), E = w({
+	}), T = C({
 		gateway: "global",
 		baseUrl: n,
 		authToken: r,
@@ -293,16 +301,16 @@ function D(e) {
 		debug: o
 	});
 }
+function D() {
+	if (!w) throw Error("Workspace client not initialized. Call initializeAppClients first.");
+	return w;
+}
 function O() {
-	if (!T) throw Error("Workspace client not initialized. Call initializeAppClients first.");
+	if (!T) throw Error("Global client not initialized. Call initializeAppClients first.");
 	return T;
 }
 function k() {
-	if (!E) throw Error("Global client not initialized. Call initializeAppClients first.");
-	return E;
-}
-function A() {
-	T &&= (T.clearStore(), null), E &&= (E.clearStore(), null);
+	w &&= (w.clearStore(), null), T &&= (T.clearStore(), null);
 }
 //#endregion
-export { w as createGraphQLClient, k as getGlobalClient, O as getWorkspaceClient, D as initializeAppClients, A as resetAppClients };
+export { C as createGraphQLClient, O as getGlobalClient, D as getWorkspaceClient, E as initializeAppClients, k as resetAppClients };

package/dist/shared/graphql/fetch.d.ts

@@ -0,0 +1,133 @@
+import { Gateway } from '../config';
+export interface GraphQLFetchOptions {
+    /** Gateway to target */
+    gateway: Gateway;
+    /** GraphQL query / mutation string */
+    query: string;
+    /** Variables for the operation */
+    variables?: Record<string, unknown>;
+    /** Operation name (optional, helps with debugging) */
+    operationName?: string;
+    /** Override auth token (if not provided, reads from profile storage) */
+    authToken?: string;
+    /**
+     * Include workspace token in X-Workspace-Authorization header.
+     * For `gateway: "workspace"`, this defaults to `true` (auto-attach) unless explicitly set to `false`.
+     * Pass `true` to auto-read from profile storage, or pass the token string directly.
+     */
+    workspaceToken?: boolean | string;
+    /**
+     * Include workspace ID in x-workspace-id header.
+     * Pass `true` to auto-read from profile context storage, or pass the workspace ID string directly.
+     * This is the "context workspace" - the user's current working context.
+     * For "target workspace" (e.g., viewing a specific workspace), use GraphQL arguments instead.
+     */
+    workspaceId?: boolean | string;
+    /**
+     * Include organization ID in x-org-id header.
+     * Pass `true` to auto-read from profile context storage, or pass the org ID string directly.
+     */
+    organizationId?: boolean | string;
+    /**
+     * Include tenant ID in x-tenant-id header.
+     * Pass `true` to auto-read from profile context storage, or pass the tenant ID string directly.
+     */
+    tenantId?: boolean | string;
+    /** Override locale (if not provided, reads from profile storage) */
+    locale?: string;
+    /** Override base URL (if not provided, reads from GATEWAYS config) */
+    baseUrl?: string;
+    /** Additional headers to merge (overrides auto-detected values) */
+    extraHeaders?: Record<string, string>;
+    /** AbortSignal for cancellation */
+    signal?: AbortSignal;
+}
+export interface GraphQLResponse<T = unknown> {
+    data: T | null;
+    errors?: Array<{
+        message: string;
+        locations?: Array<{
+            line: number;
+            column: number;
+        }>;
+        path?: Array<string | number>;
+        extensions?: Record<string, unknown>;
+    }>;
+}
+/** Read the active profile's access token from profile-scoped storage */
+export declare function getStoredAuthToken(): string | null;
+/** Read the active profile's workspace token from profile-scoped storage */
+export declare function getStoredWorkspaceToken(): string | null;
+/** Read the active profile's geography from profile-scoped storage */
+export declare function getStoredGeography(): {
+    country?: string;
+    currency?: string;
+    timezone?: string;
+} | null;
+/** Read the active profile's locale from profile-scoped storage */
+export declare function getStoredLocale(): string;
+/** Read the active profile's context (workspaceId, organizationId, tenantId, projectId) from profile-scoped storage */
+export declare function getStoredContext(): {
+    workspaceId?: string;
+    organizationId?: string;
+    tenantId?: string;
+    projectId?: string;
+} | null;
+/** Read the active profile's workspace ID.
+ * Reads from profile-scoped context (bf-p-{profileId}-context) which
+ * ActiveContextProvider now writes to on every setWorkspace() call and on init.
+ * Falls back to the ?workspace= URL param for page loads where the context
+ * hasn't been hydrated yet (mirrors MultiGatewayProvider.getWorkspaceId). */
+export declare function getStoredWorkspaceId(): string | null;
+/** Read the active profile's organization ID from profile context storage */
+export declare function getStoredOrganizationId(): string | null;
+/** Read the active profile's tenant ID from profile context storage */
+export declare function getStoredTenantId(): string | null;
+/** Resolve full gateway GraphQL URL */
+export declare function resolveGatewayUrl(gateway: Gateway, baseUrl?: string): string;
+export interface EnqueueGraphQLFetchOptions {
+    batchMax?: number;
+    batchInterval?: number;
+}
+export declare function enqueueGraphQLFetch(url: string, headers: Record<string, string>, body: Record<string, unknown>, signal?: AbortSignal, options?: EnqueueGraphQLFetchOptions): Promise<unknown>;
+/**
+ * Make a GraphQL request with automatic auth + locale headers.
+ *
+ * @example Basic query (global gateway)
+ * ```ts
+ * const result = await graphqlFetch<{ myWorkspaces: Workspace[] }>({
+ *   gateway: 'global',
+ *   query: `query { myWorkspaces { id name } }`,
+ * });
+ * ```
+ *
+ * @example Workspace query with context headers (auto-read from storage)
+ * ```ts
+ * const result = await graphqlFetch<{ workspaceResources: Resource[] }>({
+ *   gateway: 'workspace',
+ *   query: WORKSPACE_RESOURCES_QUERY,
+ *   workspaceId: true, // auto-reads from profile context storage -> x-workspace-id header
+ * });
+ * ```
+ *
+ * @example Workspace query with explicit workspace ID
+ * ```ts
+ * const result = await graphqlFetch<{ workspaceMembers: MemberList }>({
+ *   gateway: 'workspace',
+ *   query: WORKSPACE_MEMBERS_QUERY,
+ *   variables: { workspaceId: targetWorkspaceId }, // Target workspace in arguments
+ *   workspaceId: contextWorkspaceId, // Context workspace in header (for RBAC)
+ * });
+ * ```
+ *
+ * @example With explicit tokens (e.g. right after login, before storage is updated)
+ * ```ts
+ * const result = await graphqlFetch({
+ *   gateway: 'global',
+ *   query: MY_WORKSPACES_QUERY,
+ *   authToken: freshAccessToken,
+ * });
+ * ```
+ */
+export declare function graphqlFetch<T = unknown>(options: GraphQLFetchOptions): Promise<GraphQLResponse<T>>;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/shared/graphql/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../../src/shared/graphql/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAY,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAqBnD,MAAM,WAAW,mBAAmB;IAClC,wBAAwB;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,sDAAsD;IACtD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAClC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC/B;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,mCAAmC;IACnC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,eAAe,CAAC,CAAC,GAAG,OAAO;IAC1C,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IACf,MAAM,CAAC,EAAE,KAAK,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACpD,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;QAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACtC,CAAC,CAAC;CACJ;AAmBD,yEAAyE;AACzE,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAWlD;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,IAAI,CAMvD;AAkCD,sEAAsE;AACtE,wBAAgB,kBAAkB,IAAI;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,IAAI,CAaP;AAED,mEAAmE;AACnE,wBAAgB,eAAe,IAAI,MAAM,CAWxC;AAED,uHAAuH;AACvH,wBAAgB,gBAAgB,IAAI;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,IAAI,CAYP;AAED;;;;6EAI6E;AAC7E,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAEpD;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,IAAI,CAEvD;AAED,uEAAuE;AACvE,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAEjD;AAwJD,uCAAuC;AACvC,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAK5E;AAmBD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAgLD,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,OAAO,CAAC,CAyElB;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAC5C,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAwG7B"}

package/dist/shared/graphql/index.d.ts

@@ -0,0 +1,9 @@
+export { createGraphQLClient, initializeAppClients, getWorkspaceClient, getGlobalClient, resetAppClients, type CreateClientOptions, type AppClientConfig, type Gateway, } from './client';
+export { GatewayProvider, useGateway, useGatewayClient, useSafeGateway, useSafeGatewayClient, type GatewayContextValue, type GatewayProviderProps, } from './GatewayContext';
+export { graphqlFetch, getStoredAuthToken, getStoredWorkspaceToken, getStoredWorkspaceId, getStoredLocale, getStoredOrganizationId, resolveGatewayUrl, type GraphQLFetchOptions, type GraphQLResponse, } from './fetch';
+export { getWorkspaceTokenPayload, isWorkspaceTokenValidForContext, type WorkspaceTokenContext, type WorkspaceTokenPayload, } from './workspaceToken';
+export { SSELink, type SSELinkOptions } from './links/sse-link';
+export { ApolloClient, InMemoryCache, type NormalizedCacheObject } from '@apollo/client/core';
+export { ApolloProvider, useQuery, useMutation, useLazyQuery, useSubscription, useApolloClient, } from '@apollo/client/react';
+export { gql } from '@apollo/client/core';
+//# sourceMappingURL=index.d.ts.map

package/dist/shared/graphql/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/shared/graphql/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,OAAO,GACb,MAAM,UAAU,CAAC;AAGlB,OAAO,EACL,eAAe,EACf,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAIhE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9F,OAAO,EACL,cAAc,EACd,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,eAAe,EACf,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/shared/graphql/links/sse-link.d.ts

@@ -0,0 +1,48 @@
+import { ApolloLink, Observable, FetchResult, Operation } from '@apollo/client/core';
+export interface SSELinkOptions {
+    /** SSE endpoint URL */
+    url: string;
+    /** Optional headers to include with requests */
+    headers?: Record<string, string>;
+    /** Enable debug logging */
+    debug?: boolean;
+}
+/**
+ * SSE Link for GraphQL Yoga subscriptions
+ *
+ * GraphQL Yoga uses Server-Sent Events (SSE) for subscriptions over HTTP.
+ * This is more compatible with serverless and edge deployments than WebSockets.
+ *
+ * SSE Format:
+ * - event: next\ndata: {...}\n\n - Subscription data
+ * - event: complete\n\n - Subscription ended
+ * - event: error\ndata: {...}\n\n - Error occurred
+ *
+ * @example
+ * ```ts
+ * import { SSELink } from '@burdenoff/fe-libs/shared/graphql/links/sse-link';
+ *
+ * const sseLink = new SSELink({
+ *   url: 'https://gw-wspace.local.burdenoff.com/workspaces/graphql/stream',
+ *   headers: {
+ *     authorization: `Bearer ${token}`,
+ *   },
+ * });
+ * ```
+ */
+export declare class SSELink extends ApolloLink {
+    private url;
+    private headers;
+    private debug;
+    constructor(options: SSELinkOptions);
+    /**
+     * Update headers (useful for token refresh)
+     */
+    setHeaders(headers: Record<string, string>): void;
+    /**
+     * Update the authorization header
+     */
+    setAuthToken(token: string | null): void;
+    request(operation: Operation): Observable<FetchResult>;
+}
+//# sourceMappingURL=sse-link.d.ts.map

package/dist/shared/graphql/links/sse-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-link.d.ts","sourceRoot":"","sources":["../../../../src/shared/graphql/links/sse-link.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGlE,MAAM,WAAW,cAAc;IAC7B,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,OAAQ,SAAQ,UAAU;IACrC,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,OAAO,CAAyB;IACxC,OAAO,CAAC,KAAK,CAAU;gBAEX,OAAO,EAAE,cAAc;IAOnC;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;IAIjD;;OAEG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAQxC,OAAO,CAAC,SAAS,EAAE,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC;CAqJvD"}

package/dist/shared/graphql/security.d.ts

@@ -0,0 +1,13 @@
+type Geography = {
+    country?: string;
+    currency?: string;
+    timezone?: string;
+};
+export declare function getValidAccessTokenFromStorage(tokensRaw: string | null): string | null;
+export declare function sanitizeGeography(input: Geography | null): Geography | null;
+export declare function isSafeRedirectTarget(target: string, baseOrigin?: string): boolean;
+export declare function redirectToSafeLocation(target: string, fallback?: string, baseOrigin?: string): boolean;
+export declare function validateGatewayBaseUrl(value: string): string;
+export declare function sanitizeExtraHeaders(headers?: Record<string, string>): Record<string, string> | undefined;
+export {};
+//# sourceMappingURL=security.d.ts.map

package/dist/shared/graphql/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/shared/graphql/security.ts"],"names":[],"mappings":"AAkBA,KAAK,SAAS,GAAG;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAiBF,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAoBtF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CA6B3E;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,GAAE,MAA+B,GAC1C,OAAO,CAeT;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE,MAAY,EACtB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAST;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAkB5D;AAED,wBAAgB,oBAAoB,CAClC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAMpC"}